Who can do this?
Every person with an active account can request the link, even without being signed in. Only whoever reads the mailbox of the account address receives the link.
Forgot and reset password
Don’t remember your password? With a link by email you set a new one without signing in.
What is it for?
Passwords are easy to forget. So that you do not stay locked out of your account because of that, you can reset it yourself. All you need is access to the mailbox you used to sign up for Illumentis.
The procedure is like a spare key that you get for a single use: Illumentis sends you a link by email. It is valid for two hours and can be used only once. With the link you set a new password.
For security reasons, the page does not reveal whether an account exists for an address. It answers everyone the same way. That way nobody can try out addresses to find out who uses Illumentis.
After the reset, Illumentis ends all previous sign-ins on all devices. You then sign in again. This protects you in case someone else was signed in with your old password.
How it works
-
On the sign-in page, click “Forgot password?”.
What you see afterwards: The page asks for your email address.
-
Enter your email address and choose “Request link”.
What you see afterwards: “If an account exists for this email, a message has been sent.”
-
Open the email and click the link.
What you see afterwards: A page with the field “New password” opens.
-
Enter a new password with 8 to 128 characters and choose “Set password”.
What you see afterwards: You land on the sign-in page again.
-
Sign in with the new password.
What you see afterwards: If you have activated two-factor, the sign-in asks for your “Verification code”.
Your data
Illumentis stores only a fingerprint (hash) of the link and its expiry time, not the link itself. Illumentis also stores your new password only as a hash.
Limits
The link is valid for two hours and only once; after that the page reports “Invalid or expired token.”. At most 5 requests per hour are possible per address. Resetting does not replace two-factor recovery.
Frequently asked questions
I do not receive an email. What now?
Check your spam folder and the spelling of the address. No email is sent for an address without an active account, nor for an address that Illumentis rates as unsafe. The page answers the same way in all cases. 5 requests per hour are possible per address; after that the page shows “Too many requests - please try again later.”.
Will I be signed out after the reset?
Yes. Illumentis ends all previous sign-ins on all devices. You sign in again with the new password.
Do I have to enter a two-factor code again afterwards?
Yes, if you have activated two-factor. Resetting does not change that setting. If you have lost the device, account recovery helps.